Re: selinux prevents msgrcv on restore message queues?

[Nathan Lynch <ntl-e+AXbWqSrlAAvxtiuMwx3w@public.gmane.org>]

On Wed, 2010-03-03 at 13:49 -0600, Serge E. Hallyn wrote:
> Quoting Nathan Lynch (ntl-e+AXbWqSrlAAvxtiuMwx3w@public.gmane.org):
> > On Tue, 2010-03-02 at 19:19 -0600, Serge E. Hallyn wrote:
> > > Can you try the following patch?
> > > 
> > > Also, to actually restore the LSM labels you need to add -k to your
> > > restart flags, but without the -k you should get a sane default
> > > security label.
> > 
> > Thanks, the ipc/mq tests pass with this patch and restart -k.  Without
> > -k the tests still fail in the same manner (msgrcv fails).  Is that the
> > behavior you'd expect?
> 
> Not really - the test runs as unconfined_u right?

I added a ps -Z to test-mq.sh before thawing:

# PATH=/root/cr/user-cr.git:$PATH bash test-mq.sh 
Using output dir ./cr_mq_6T8KIG6
XXX Test 1: simple restart with SYSVIPC msq
check-mq: no process killed
../common.sh: line 45:  5173 Killed                  ( sleep $1; kill -s USR1 $$ )
LABEL                             PID TTY          TIME CMD
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 4358 pts/1 00:00:00 bash
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5151 pts/1 00:00:00 bash
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5172 pts/1 00:00:00 nsexec
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5175 pts/1 00:00:00 sleep
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5178 pts/1 00:00:00 check-
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5183 pts/1 00:00:00 ps
PASS


>   I'd expect the
> msg to get created with the same type both when you just run the
> original program and when you restart it.  If you just run the
> checkpointed program and let it complete, doe sit also get a
> denial at msgrcv?

No, the msgrcv calls succeed if I alter the testcase to resume the
original process instead of killing and restarting it.